CVE-2020-18190 : What You Need to Know

Bludit v3.8.1 is affected by a directory traversal vulnerability that allows remote attackers to delete arbitrary files via /admin/ajax/upload-profile-picture.

Understanding CVE-2020-18190

Bludit v3.8.1 directory traversal vulnerability

What is CVE-2020-18190?

This CVE refers to a security flaw in Bludit v3.8.1 that enables attackers to perform directory traversal and delete files through a specific endpoint.

The Impact of CVE-2020-18190

Remote attackers can exploit this vulnerability to delete arbitrary files on the affected system.

Technical Details of CVE-2020-18190

Details of the vulnerability

Vulnerability Description

The vulnerability in Bludit v3.8.1 allows for directory traversal, leading to unauthorized file deletion via the /admin/ajax/upload-profile-picture endpoint.

Affected Systems and Versions

Affected Version: Bludit v3.8.1

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating the file path in the upload-profile-picture function, enabling them to delete files outside the intended directory.

Mitigation and Prevention

Protecting against CVE-2020-18190

Immediate Steps to Take

Disable the affected functionality or endpoint until a patch is available.
Monitor system logs for any suspicious activities related to file deletions.

Long-Term Security Practices

Regularly update Bludit to the latest version to ensure patches for known vulnerabilities are applied.

Patching and Updates

Apply patches or updates provided by Bludit to address the directory traversal vulnerability in v3.8.1.